windows-lateral-movement

A Windows lateral-movement playbook for moving between hosts once an initial foothold and suitable credentials are held. It compares remote-execution methods and documents the specific tooling and credential types each requires, so an operator, for example in a red-team or penetration-testing engagement, can pick a technique by port, credential type, OPSEC profile, and privilege requirement. A comparison table summarises PsExec, Impacket smbexec and atexec, WMI, WinRM, DCOM, RDP, SSH, and SC across their port, accepted credential type, whether they create a service, whether they drop a file on disk, relative OPSEC noise, and admin requirement. PsExec variants are shown with Impacket (password, NTLM hash for pass-the-hash, and Kerberos ticket), the stealthier smbexec (no binary upload) and atexec (scheduled task), and Sysinternals PsExec64 including SYSTEM execution. WMI covers Impacket wmiexec, PowerShell Invoke-WmiMethod process creation, and a WMI event-subscription persistence example. WinRM covers evil-winrm (password, hash, Kerberos) and PowerShell remoting via Enter-PSSession and Invoke-Command, including fan-out to multiple targets. DCOM demonstrates MMC20.Application, ShellWindows, and ShellBrowserWindow objects plus Impacket dcomexec. Credential-reuse techniques are laid out in detail: pass-the-hash with CrackMapExec, Impacket -hashes, evil-winrm -H, xfreerdp /pth with the registry change to enable Restricted Admin, and Mimikatz sekurlsa::pth; overpass-the-hash and pass-the-key converting an NTLM hash or AES256 key into a Kerberos TGT via getTGT.py to avoid NTLM logging; and pass-the-ticket using a ccache with KRB5CCNAME, Mimikatz kerberos::ptt, or Rubeus. A pivoting section covers SSH dynamic SOCKS proxies and local port forwards plus Chisel for tunnelling without SSH. The playbook cross-references companion material for privilege escalation after landing on a host, AV and EDR evasion when tools are blocked, Active Directory Kerberos and ACL abuse for Kerberos-based paths, and a credential-dumping reference for LSASS, SAM/SYSTEM, DPAPI, and NTDS.dit extraction. Method fingerprints, OPSEC trade-offs, and per-method credential requirements are emphasised throughout.